ignore gpg

.gitignore

@@ -1,3 +1,4 @@
 cosign.key
 cosign.private
 /Containerfile
+/.bluebuild-scripts_*

files/scripts/install-nix.sh

@@ -5,9 +5,16 @@ rpm_url="https://nix-community.github.io/nix-installers/nix/x86_64/nix-multi-use
 
 install -d /usr/share/nix-store /var/lib/nix-store /var/cache/nix-store /nix
 
-dnf install -y "$rpm_url"
+# Avoid systemd calls during RPM %post in the image build environment.
+export SYSTEMD_OFFLINE=1
+
+# Install the RPM; allow missing GPG key since we fetch directly by URL.
+dnf install -y --nogpgcheck "$rpm_url"
 
 # Move the pre-populated store out of /nix so it can serve as the immutable lowerdir.
 if compgen -G "/nix/*" >/dev/null; then
   mv /nix/* /usr/share/nix-store/
 fi
+
+# The RPM %post handles sysusers/tmpfiles; if we ran with SYSTEMD_OFFLINE the
+# post scripts are still executed, so no extra calls are needed here.